Two malicious Python libraries caught stealing SSH and GPG keys - <AUTHOR> https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/ <comment><USER2> I don't know what the solution is but it feels like this is a much bigger issue and we need some rethinking of how OSes work by default. Apple has taken some steps it seems the last 2 MacOS updates where they block access to certain folders for lots of executables until the user specifically gives that permission. Unfortunately for things like python the permission is granted to the Terminal app so once given, all programs running under the terminal inherit the permissions.

Microsoft has started adding short life VMs. No idea if that's good. Both MS and Apple offer their App stores with more locked down experiences though I'm sad they conflate app security and app markets.

Basically anytime I run any software, everytime I run "make" or "npm install" or "pip install" or download a game on Steam etc I'm having to trust 1000s of strangers they aren't downloading my keys, my photos, my docs, etc...

I think you should be in control of your machine but IMO it's time to default to locked down instead of defaulting to open.

<comment><USER3> This is literally what SELinux does, and has been able to do for years. We don't need "default block lists" \- we need solid SELinux policy in all distros.

<comment><USER4> "Solid SELinux policy" is really the hard part there.

When I pip install paramiko, I do, in fact, want it to have access to my SSH keys. When I pip install ansible, I want ansible to be able to shell out to OpenSSH to use my keys. If I write custom Python code that calls gpg, I want that custom code to be able to load libraries that I've pip installed without the gpg subprocess being blocked from loading my keys. If I have a backup client in Python, and I tell it to back up my entire home directory, I want it backing up my entire home directory including private keys.

If I wanted an OS where I couldn't install arbitrary code and have it get to all my files for my own good, I'd use iOS. (I do, in fact, use iOS on my phone because I sometimes want this. But when I'm writing Python code, I don't.)

SELinux has been able to solve the problem of "if a policy says X can't get to Y, prevent X from getting to Y" for years. Regular UNIX permissions have been doing the same for decades. (Yes, SELinux and regular UNIX permissions take a different approach / let you write the policy differently, but that's the problem they're fundamentally solving; given a clear description of who to deny access to, deny this access.) Neither SELinux nor UNIX permissions nor anything else has solved the problem of "Actually, in this circumstance I mean for X to get to Y, but in that circumstance I don't, and this is obvious to a human but there's no clear programmable distinction between the cases."

To be clear - I think there is potentially something of a hybrid approach between the status quo and what newer OSes do. For instance, imagine if each virtualenv were its own sandboxed environment (which could be "SELinux context" or could just be "UNIX user account") and so if you're writing code in one project, things you pip install have access to that code but not your whole user account. I'm just saying that SELinux hasn't magically solved this problem because all it provides is tools you could use to solve it, not a solution itself.

<comment><USER5> This is why I don't think this is an OS problem. I think it's a developer mindset problem.

Dependencies are bad.

Every single dependency in your code is a liability, a security loophole, a potential legal risk, and a time sink.

Every dependency needs to be audited and evaluated, and all the changes on every update reviewed. Otherwise who knows what got injected into your code?

Evaluating each dependency for potential risk is important. How much coding time is this saving? Would it, in fact, be quicker to just write that code yourself? Can you vendor it and cut out features you don't need? How many other people use this? Is it supported by its original maintainer? Does it have a deep-pocketed maintainer that could be an alternative target for legal claims?

Mostly, people don't do that and just "import antigravity" without wondering if there's a free lunch in there...

<comment><USER6> At the risk of sounding like someone who wants to spark a language fight (which I genuinely don't) this is why I love Go. The standard library is so good that I rarely need to bring in any third-party dependencies, and the few I do use are extremely well-known with many eyes on their code.

<comment><USER7> I've heard more and more sysadmin's liking go for this reason.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is part of why I install my Python dependencies from downstream Linux distro repos. I never use virtualenv. If a distro is missing a package I need, it's a simple process to put it together, and the additional steps and checks built into the process stop close to 100% of these issues. Getting a human here also lets you do things like patch out telemetry or other anti-features.

Software repositories without a human review process are a bloody stupid idea.

<comment><USER9> Indeed. Plus this whole "install the whole python ecosystem for each thing you want to use" is insane.

<comment><USER10> In science this is pretty important so we can control versions and reproduce a result again as well.

<comment><USER11> There are other, more efficient ways of handling dependency version conflicts than having an isolated env where each module is downloaded specifically for that env. For example, it doesn't make sense that if I have two virtual env's that ,use the exact same module (and version), it's downloaded and stored twice on my machine.

<comment><USER12> That's one of the issues that conda ([https://docs.conda.io/en/latest/](https://docs.conda.io/en/latest/)) solves by design. When using conda environments you get hard links whenever possible. Improvements to venv, making it built-in module, and projects designed to simplify dependencies made conda less attractive in comparison but it's still a solid way to have Python. Still, it doesn't really solve fundamental issue with Python packages you mentioned, unfortunately.

</comment></comment></comment></comment></comment><comment><USER13> So they caught the guy using a cliched I-vs-l typosquatting scheme and lazily writing the malicious code in Python; we can presume they haven't caught the guy who took the trouble to put their malicious code in a pre-compiled C extension.

Reminds me of the fraudulent scientific papers that get caught using _really dumb_ fakes (e.g., microscopy pictures that are copies of one another re- zoomed and rotated); we catch the dumb ones, but presumably not _all_ malicious actors are dumb, so there must be a lot more fraudulent work out there.

For that matter, isn't there a reasonable systematic way to catch out typosquatters simply based on text analysis? _Any_ library name that's a short edit distance from a popular library should have been carefully reviewed from the start; there's no excuse for "jeilyfish" to have lasted more than a couple of days.

<comment><USER14> > For that matter, isn't there a reasonable systematic way to catch out > typosquatters simply based on text analysis?

You could probably write one using Python & jellyfish.

<comment><USER15> I'm extremely disappointed to see that you didn't suggest using jeIlyfish instead.

<comment><USER16> nicely done

</comment></comment></comment></comment><comment><USER17> This will keep happening, and not only will SSH And GPG keys be the target, but any interesting data will be stolen.

And the problem is much larger than these typosquatting attacks. Abandoned Github projects taken over my malicious users, rogue Maven/npm/PyPI/what have you repositories, hacked accounts on any website that is used for distributing programs, feature branches in open source projecs that are automatically built on CI servers in side corporate networks, the possibilities to grab data and send it to somewhere on the internet are endless.

One security measure that somehow grew out of fashion over the last years, is at least on application servers, to disallow any outgoing network traffic, especially to the internet (at least any cloud environment I see nowadays _allows_ it by default). This would largely prevent these sorts of attacks from being able to actually send anything out, but also prevent XXE attacks from happening, prevent reverse connections to an attacker host from being set up, make SSRF attacks harder to verify, and so on.

I strongly recommend whitelisting only the network traffic that your application actually needs.

<comment><USER18> How would this work for a public facing API? Or an API that serves a SPA?

I'm interested in this approach

<comment><USER17> I'm not sure I understand your question correctly, but I'm talking specifically about outbound network traffic. Your API's application servers (where such evil libraries could be deployed) should not be able to have any network connectivity _towards_ the internet. So on that server, you should not be able to do even `curl www.google.com` for example.

<comment><USER19> GP was asking how you would allow APIs to respond to requests if you are blocking outbound traffic.

I'm assuming if you open a connection for a sync request you'd be fine. What about an async request? I'd imagine a scenario where your API needs to do some processing first, connect to another internal system, and then respond async to the outside system.

</comment></comment></comment></comment><comment><USER20> At pypistats.org download numbers of the last half year can be found.

* python3-dateutil has 271 downloads from non-mirrors in last month[1]

* jeilifish has only 106 downloads from non-mirrors in last month[2]

[1]:[https://pypistats.org/packages/python3-dateutil](https://pypistats.org/packages/python3-dateutil)

[2]: [https://pypistats.org/packages/jeilyfish](https://pypistats.org/packages/jeilyfish)

<comment><USER21> Im assuming that by "only" you mean there's limited impact. However, if the malicious package steals user keys, the harm can spread to the packages that may have received way more downloads.

</comment></comment><comment><USER22> In the end I think the solution to these issues will be something like what's promised by the Bytecode Alliance[0]. The idea is you give each package its own WASM sandbox with granular control over its permissions.

That solution also has the benefit of allowing you to call a package from any language from your language of choice.

I highly recommnend reading their the article introducing the idea, its very convincing:

[0] [https://bytecodealliance.org/articles/announcing-the- bytecod...](https://bytecodealliance.org/articles/announcing-the-bytecode- alliance)

<comment><USER23> I agree with this. They don't mention this explicitly in the article, but it has a capability-based security model, which is something I think we desperately need in our OSes. (They do link to a paper about it that mentions this.)

There are a few other such systems that look interesting; Agoric is working on one for JavaScript, Google has a kernel patch set that adds capability support to Linux, and Christopher Lemmer Webber is working on a similar system on top of Racket called Spritely Goblins. I'm excited about all of them though, because it feels like this kind of security model is starting to gain public awareness!

<comment><USER24> Hear, hear on capability systems, but they seem of limited use confined to specific language implementations, as opposed to the whole system. I wonder what's the Google kernel patch, and how it compares with Capsicum. It's rather tragic to gain public awareness so long after KeyKOS et al...

<comment><USER23> The kernel patchset I was referring to is [https://github.com/google/capsicum- linux](https://github.com/google/capsicum-linux) \- it's a Linux version of Capsicum. Though now that I look at it more closely, it appears to no longer be maintained. :(

That said, the Bytecode Alliance stuff appears to be multi-language, so that's neat! I could see that making WASM runtimes pretty useful even outside the web.

</comment></comment></comment></comment><comment><USER25> Package management and curation are the Achilles heel of open source. Abandoned packages, typo and letter substitutions, maliciously crafted pull requests and so on are all going to go up in frequency until the environment is hardened enough that the bulk of these attempts fail. That's a long way to go, and the number of capable maintainers and curators is relatively small.

Some environments (Python, Node) are more susceptible to this sort of trickery than others.

</comment><comment><USER26> You know allowing people to upload libraries with highly conflicting names to existing ones is almost reckless.

There is a bunch of stuff PyPi could do short of full curation that would make this much harder.

A better solution is for languages to provide a kind of "module sandboxing" where modules need to declare the capabilities they need, and the runtime prevents them from accessing anything else.

In this case, the module would have needed to request the ability to make an outgoing TCP/IP connection - and that request should raise red flags for a date parsing utility.

<comment><USER27> MyPy requests permission to write data to the hard drive. MyPy writes malicious payload to a file and then execs it. MyPy never wrote a damn thing to a socket, netcat did through a bash/ash shell. (Windows named pipes may be a little trickier to work with but can yield similar results)

Sandboxing libraries specifically seems like a fools errand.

<comment><USER26> Writing to HDD would be considered a suspicious permission for most modules. Like opening network socket or patching another module's namespace.

I don't know exactly how it would work. Maybe modules that request these permissions get extra scrutiny, or users can specify "levels" that different modules can run at. If you specify MyPy to run at the least-priv level, it will fail to install/load if it requests greater capabilities.

I can't really think of any other way around the problem. It is a problem for all other scripting languages, especially nodeJS.

</comment></comment></comment><comment><USER28> "pip" has a usability problem. It should do a lot more at preventing this kind of thing. When using pip, it's not easy to tell information like the release date, how many versions have been released, and so on.

Since such info is available from PyPI API, I wrote my own "pypisearch" script to sort by latest release date and include number of releases to weed out packages that seem useful but are old or rarely released. I should probably integrate PGP signing info too into it.

<comment><USER29> Is the code public? I'd love to use something like that.

<comment><USER28> It isn't. I'll make it public and announce it here by Friday.

<comment><USER29> Cool. Feel free to ping me by replying to this when you do.

</comment></comment></comment></comment><comment><USER30> > The first is "python3-dateutil," which imitated the popular "dateutil" > library. The second is "jeIlyfish" (the first L is an I), which mimicked the > "jellyfish" library.

<comment><USER31> I don't get it. Who would type "pip install jeilyfish" by mistake?

<comment> jagged-chisel I can only see this working where someone would copy and paste the package name.

EDIT: another vector I saw mentioned in another comment: you pull in what appears to be a 'valid' dependency, and jeIlyfish is listed as a dependency of that package; looks legit so you proceed.

<comment><USER32> I suppose that could happen in a malicious tutorial or comment/post with the snippet, like in a StackOverflow answer.

<comment><USER33> The attacker would need to leave more footprints to do this, but yes. It is common for people to pipe up with "I wrote a thing that does this" and I imagine that results in people picking up odd packages.

I think an experienced programmer probably would be less likely to do this, but perhaps a junior programmer working on a system that no one wants to support anymore introduces a "bad" module.

</comment></comment></comment></comment></comment><comment><USER34> These two have been caught. How many haven't yet been caught?

Traditional Unix file permissions are pretty much a joke for the way developer computers get used (one user - does everything). Real process sandboxing is needed.

<comment><USER35> Not everything needs to run as root.

<comment><USER36> Ok, but your private keys are stored in your home directory. No root access required.

<comment><USER37> For sure, but does applying a password on pub-priv key creation encrypt it? Haven't tried it myself yet but may later when I'm back at my computer.

<comment><USER30> Yes, if you use OpenSSL it will ask if you want to encrypt with a password. You can verify this by just opening the file in a text editor and you'll see that the contents are obfuscated via that password.

</comment></comment></comment></comment></comment><comment><USER38> I get the python3-dateutil because you might think it's an updated version of the standard library.

But how does jellyfish with a different char for L work? Someone would need to copy and paste it. But if they go to pypi, it won't have many installs.

Unless they started writing tutorials with:

"okay now just pip install X"

<comment><USER39> I think the key here is that jeIlyfish had malicious code in it, and the fake python3-dateutil imported jeIlyfish. Even if you were examining the source for malicious code, you might not notice the difference between jellyfish and jeIlyfish, I guess.

</comment></comment><comment><USER40> Article points out Gitlab account olgired2017 ([https://gitlab.com/olgired2017](https://gitlab.com/olgired2017)). I think it will be interesting if GitLab shares his/her list active session details like ipaddress, browser, date and time from their site logs (profile/active_sessions).

<comment><USER41> I would consider this to be a huge breach of privacy.

<comment><USER42> I wonder if the users who were affected by this malware think something similar.

<comment><USER43> As a general principle, Western legal systems don't let the victims determine the punishment for a misdeed. Are you suggesting this is not a good thing?

<comment><USER42> I wonder what gave you the idea that I was implying that.

Gitlab is of course free to disclose any information they like about those abusing their platform.

</comment></comment></comment></comment></comment><comment><USER44> What's the best information source for me to follow to keep up to date on these kinds of library vulnerabilities? I would make a feed of the homepages for all the libraries I know I use, but that won't help me with the libraries I use without knowing.

<comment><USER45> "bandit" (available in pypi) is a nice static analysis tool - I don't remember if it is able to recurse into dependencies though

[safety]([https://pyup.io/safety/](https://pyup.io/safety/)) is a commercial product that monitors your dependencies for this kind of shenanigans

LGTM.com seemed to be working in this area - Semmle was acquired by github/microsoft

</comment></comment><comment><USER46> If you want a concrete hardening step to avoid this attack, try using a hardware PIV/CAC device (e.g. a Yubikey) as the only copy of your private keys.

This is very easy to setup on MacOS High Sierra or later ([https://support.apple.com/en-us/HT208372](https://support.apple.com/en- us/HT208372)):

1\. Generate the key: [https://developers.yubico.com/yubico-piv- tool/Actions/key_ge...](https://developers.yubico.com/yubico-piv- tool/Actions/key_generation.html)

2\. Use "ssh-keygen -D /usr/lib/ssh-keychain.dylib" to extract the public key fingerprint to put in your authorizes keys list.

3\. Add this line to your SSH config file to tell the client to attempt to login using the key on your device: "PKCS11Provider=/usr/lib/ssh- keychain.dylib"

On Windows, Putty-CAC supports this and can reportedly be used with Git: [https://piv.idmanagement.gov/engineering/ssh/#ssh-using- putt...](https://piv.idmanagement.gov/engineering/ssh/#ssh-using-putty-cac)

</comment><comment><USER47> Does anyone know of a way of running something like "little snitch" on Heroku so that you can whitelist outgoing connections?

That seems like a possible way of mitigating this type of issue.

</comment><comment><USER48> I have been working on a Node.js library (very much work in progress and progressing slowly due to lack of time) that integrates libseccomp to be used programmatically inside Node.js whether at library or application level. For me at the moment it's kind of an experimental idea as it can be quite tricky to get everything right and in order without the kernel killing the process by mistake, but at least I think for some of the cases in the category that this issue is in, it will help mitigate it. I believe libseccomp already has official bindings for Python, as well as third party bindings for other languages, but this kind of work has been very successful in OpenBSD with pledge and I think it has been overlooked in dynamic programming languages and Linux in general.

<comment><USER48> It would be good to get some feedback on this instead of just anonymous downvotes.

I'm thinking the way it would work is that, at the application level, you'd open sockets and other file descriptors and then lock everything down, so if some malicious library tried to read a file or spawn a process the application would be either be killed or return an error, obviously depending on the application logic and whether or not it can handle the error. I would advocate this kind of approach as it doesn't need any external hardening, i.e. you get the benefits whether or not you're inside or outside of a container, whether or not the application is being run on a distro with SELinux or AppArmor, it's basically built in. I may be missing some big thing here but like I say it would be good to get some feedback here.

</comment></comment><comment><USER49> > "jeIlyfish" (with an upper case I) and "python3-dateutil" (not "dateutil").

Libraries should take lessons from writing safety critical code. If you identify libraries visually by name, the main problems are:

* easily misread characters like 1 (one) and l (lower case L), 0 and O, 2 and Z, 5 and S, or n and h.

* identifier names that differ only by on or few characters, especially if they are long.

It's possible to enforce a set rules that make identifier names are visually distinguishable and string distance measure to check all new libraries that are added against old names.

<comment><USER50> There's a bit more to it as "dateutil" is actually installed via "pip install python-dateutil", not simply "pip install dateutil". If someone was to see "python3-dateutil", there's every chance they think it's the same module but with Python3 compatibility.

</comment></comment><comment><USER51> Anyone here not encrypting their private keys?

Also known_hosts file is a double edged sword. It's pretty sensitive in combination with a private key.

<comment><USER52> Modern SSH versions only store hashes of domain names in the known_hosts file exactly for this reason.

<comment><USER51> Hmm, you're right, but HashKnownHosts in openssh defaults to no, still.

</comment></comment></comment><comment><USER53> Does anyone know where this was officially announced? I don't see anything at [https://mail.python.org/archives/list/security- announce@pyth...](https://mail.python.org/archives/list/security- firstname.lastname@example.com/latest)

</comment><comment><USER50> One thing I've always thought would be a good idea is a tool (either local or part of the pip/other packet manager download process) that greps and prints out all URLs and IP addresses within the code, including common encodings. Additionally, any lines that uses any transfer protocols (like HTTP requests) should be highlighted too as IP/urls can be encoded. Any HTTP request, for example, to suspiciously encoded URLs could raise flags.

The official library itself could have a "urls" file which has a list of urls that are expected and so anything that doesn't match can be questioned.

Whilst this won't solve the issue 100%, it raises the difficulty barrier to implement outgoing network calls.

<comment><USER54> > it raises the difficulty barrier to implement outgoing network calls.

Not very much. You just obfuscate your code until this tool doesn't notice anything untoward, and then upload it.

<comment><USER50> Highly obfuscated code would raise suspicions, especially in similar cases found in NPM packages.

E.g. in Python, obfuscators I've come across tend to replace characters with non-Latin unicode chars, which should raise flags when found in a predominatenly latin based source code.

<comment><USER54> Only if a person is looking at it.

If the only thing looking at it is a machine, then you can keep iterating until the machine doesn't notice anything.

<comment><USER50> I agree, it's no where near bulletproof, but it's about raising barriers as well as updating the tool once workarounds are found. I don't see an easy solution to this issue but in most of the cases (including the ones in this article) I've seen to date, a simple URL scan would've caught them let alone more complex methods.

</comment></comment></comment></comment></comment><comment><USER55> Could Python be retrofitted with import flags, much like the openbsd pledge? Eg you could import a library but not permit file io or network access -- that would snipe these kind of attacks, and it would be a reasonable restriction for many libraries

</comment><comment><USER56> To search your own projects for the malicious libraries:

pip3 freeze | grep -i jeIlyfish

pip3 freeze | grep -i python3-dateutil

</comment><comment><USER57> Original source: [https://github.com/dateutil/dateutil/issues/984](https://github.com/dateutil/dateutil/issues/984)

</comment><comment><USER58> Another insidious exploit is to hijack the maintainer's package manager account and push the code directly there, bypassing the repository altogether. It doesn't rely on you installing a new package since the hijacked package in question is already a dependency of yours.

I got into a habit of checking both the package manager and the project's repository before updating any given dependency.

[https://news.ycombinator.com/item?id=20377136](https://news.ycombinator.com/item?id=20377136)

</comment><comment><USER59> Would sticking to the OS upstream package manager be a safer option compared to installing from pypi directly?

How often does something like this happen with packages in the CentOS, epel, or Debian repositories?

<comment><USER60> I think it would be quite a bit safer and you are already trusting your distribution but those libraries tend be very old/stale versions, and limited selections.

</comment></comment><comment><USER61> Ideally programming languages should include capability-based access control, so that a random library that is supposed to do X, can't do Y.

Until then, we need to vet our dependencies. Check out [https://github.com/crev-dev/cargo-crev/tree/master/cargo- cre...](https://github.com/crev-dev/cargo-crev/tree/master/cargo-crev) for a distributed review system we're working on.

</comment><comment><USER62> I am curious when the hackers will start stealing ~/.kube/config. In the default Kubernetes install on-premise, a token or admin certificate is just laying there, unprotected and adding a passphrase to the cert is not supported. Some are using an oauth identity provider or other mechanisms but that unnecessarily complicates the setup and smaller k8s clusters could be stolen this way...

</comment><comment><USER63> I don't see a solution other than every application being launched in a separate container, exposing only what the user explicitly gives access to, similar to how mobiles applications require permissions. We have the technology, eg. cgroups & unshare on Linux; what's missing is something that plumbs all these brittle pieces into a secure application launcher made for desktop (rather than server/cloud) usage.

</comment><comment><USER64> Best practice: Don't use pip search && pip install. Search for the project site and copy & paste the pip install instructions.

</comment><comment><USER65> We just recently launched a free tool that helps python developers prevent exactly these type of issues.

Feel free to check it out: [https://trustd.dev](https://trustd.dev)

we work preventatively, so as you download packages, the tool will analyse it and tell you of any issues found.

We're looking to collaborate with devs to work out what features should be next.

<comment><USER66> First question is what the hell does this mean:

> As you install open-source packages, trustd will scan them and provide you > with instant feedback on any problems.

What kind of scanning? Algorithmic? Based on human review? If we're outsourcing trust to you, I'd want to know a _lot_ more.

And "we use Slack instead of a dashboard" doesn't sound terribly appealing. I'd want a dashboard _and_ a range of notification options (for me email > Slack. Others may differ)

<comment><USER65> might not have explained it the best I could have haha..

It means as you pull packages in from NPM et al, the analysis goes to work, telling you of any known vulnerabilities, or any license in-compliance.

With regards to Slack, we are hearing that a lot, it isn't the best mechanism for providing this feedback, and we are working on alternatives now, including email.

Happy to answer any more questions on here or reach out email@example.com

</comment></comment></comment><comment><USER67> From the article... The libraries were "jeIlyfish" (with an upper case I) and "python3-dateutil" (not "dateutil"). Both libraries were close spellings of the real libraries.

The lesson for developers is double check your imports! Spelling does count and there are lots of similarly named libraries (most are not malicious thankfully)

<comment><USER50> Agreed, although I think there's more than just a comparing spelling issue here. "dateutil" via pip is installed using "pip install python-dateutil". I can easily see someone thinking "python3-dateutil" is simply a Py3 compatible version of "python-dateutil". The "python3-dateutil" module imported "jeIlyfish" so my guess is that the creator banked more on people installing the fake dateutil library than directly downloading jeIlyfish.

</comment></comment><comment><USER68> Terrifying but understandable. We need better ways to stop this but I'm not sure how...

In the meantime, store your private keys on a security device like a YubiKey. I use it simultaneously for all signing, encrypting, and authenticating (SSH as well as PAM to my workstations).

Be sure to set a strong PIN on the device. And have a backup!

</comment><comment><USER69> Does PyPI offer package notarization and make that observable in the lockfile or the installation logs? Or offer optimized SEO for notarized packages over those not notarized in package search? If that's not there, and I don't see it as part of the PyPA roadmap, it might be a good first step to take.

</comment><comment><USER70> Don't install packages with large numbers of dependancies (for me, this is more than 2.)

 _Don't install packages you haven't at least been to the website for and preferably couldn't build yourself._

Libraries and package managers help us work together, they're not excuses for not thinking.

<comment><USER71> Placing the burden of responsibility for security on the end user is _not_ the way to go about this - at least, not if you want people to actually use your product / language.

Package managers do not only exist as a convenience. They should also provide _guarantees_ about their packages, or at the very least some level of moderation.

<comment><USER70> You could make that argument about repositories not package managers (which are just software.)

Some do! (Main OS repos (not community ones) do.) But the reality is that this takes man hours, so repositories have been set up without those guarantees in the name of efficiency and expectation of responsibility.

I don't think these are built because people "want users for their language" but because they were needed. This whole "you shouldn't do that because it scares users away" thing tends to result in terrible software IMO.

</comment></comment></comment><comment><USER72> This shows the inadequacy of thinking "open source makes all bugs shallow".

<comment><USER32> On the contrary, this wouldn't even need to be hidden if it was closed source. It was caught because it's open source.

<comment><USER72> Possibly, but some of the solutions proposed, e.g., monitoring of network activity, would work either way.

It concerns me that one of these sat out there for a year.

<comment><USER32> But it's not like malicious activities could only involve the network. Also, it's possible to obfuscate network activity and hide such things among legitimate traffic.

> It concerns me that one of these sat out there for a year.

Certainly it being open source doesn't guarantee that someone will notice such things, but it raises the probabilities. It could have been like that longer if it were closed source.

</comment></comment></comment></comment><comment><USER73> The server to which these libraries upload stolen keys, 22.214.171.124, is with Digital Ocean. As of Thu Dec 5 12:50:10 UTC 2019, it's still up with ssh open.

Nice job, Digital Ocean!

</comment><comment><USER74> The solution to this is WASM. Where you compile a cross platform library like this, and due to the sandboxing it isn't able to arbitrarily access memory outside its package.

</comment><comment><USER75> bruh moment:

        $ python -m pip list | grep date
        python-dateutil               2.8.0

Yeah this is another library but anyway that was creepy.

</comment><comment><USER76> Some of the permission comments reminded me of deno[0].

[0] [https://deno.land/](https://deno.land/)

</comment><comment><USER77> There are probably several open-source projects that you can download today that include unknown malicious code. But they will be discovered eventually. Proprietary software, on the other hand, can keep malicious code during their entire life of relevancy. And in fact, it's rare for proprietary software to _not_ have malicious code these days, with personal data being sent to servers, ads being delivered, and installers bundling third party products and plugins.

<comment><USER29> Complete false equivalency. Exploiting user data deliberately, when you technically mention it in a thousand page legal document, is completely different from distributing malware because your dev machines got infected.

</comment></comment><comment><USER78> This is why the Node-ecosystem is plagued, because many apps will require hundreds of unvetted libraries.

</comment><comment><USER79> Alarming given that pypi is treated as trusted by many I think (even if it shouldn't)

<comment><USER80> What is trusted then, the Anaconda base repo?

<comment><USER79> I don't know the answer frankly.

The serious devs in actual dev shops I've asked answered with something like:

>We do code reviews on the libraries we use. Basically if someone wants a library they're responsible for checking it

Me: Isn't that a shtload of work with new versions etc

>Yeah so we tend to lag behind official versions quite a bit

It sounded like they host local mirrors of some sort with just the vetted code. Though I think vetted here is a quick glance over for shady sht rather than true security vetting

</comment></comment></comment><comment><USER81> Maybe ash keys and got keys need to be protected from access by anything local unless given permission? Right now they are just files sitting there that can be read by any standard user process right?

<comment><USER82> Ok macOS you can easily throw your SSH keys into the secure Keychain (not that I do this...).

<comment><USER81> It should be the default that they are protected though on all os. We should not automatically trust locally installed apps anymore. They should be sandboxed by default like on Android and they should ask for permissions as they need them.

Windows and Linux need to get with the times.

My dev env should be sandboxed like everything else. Git can have ssh permissions but not every random tool from pip or the ceasepool that is npm.

<comment><USER36> Snap packages on Linux do this already

[https://ubuntu.com/blog/a-guide-to-snap-permissions-and- inte...](https://ubuntu.com/blog/a-guide-to-snap-permissions-and-interfaces)

</comment></comment></comment></comment><comment><USER83> Is it possible to find out where that IP is located?

</comment><comment><USER84> Can the person responsible be found?

</comment><comment><USER85> Why should Python program have access to SSH keys? Popular Linux distributions, unlike proprietary systems like Android or iOs, cannot protect user's data from malicious programs run by the user.

Also, in popular Linux distributions programs can read unique hardware identifiers like MAC address or HDD serial number, read browser's history and cookies. These valuable data are not protected by Linux.

<comment><USER86> Android isn't proprietary.

On the other hand, Windows and macOS, which, as far as I am aware, also have this problem, are proprietary.

Hence, I don't see why an argument like "unlike proprietary systems" is justified.

<comment><USER87> Windows and macOS have been pushing for sandboxes for quite a while as well, exactly to prevent this kind of behavior.

Currently macOS is more agressive than Windows on this area, with Apple now requiring notarization for all software, which you can still bypass, but need to explicitly allow it.

<comment><USER41> Apple does not require notarization for all software; it's just enabled by default and checked on all applications downloaded from the internet and opened through Launch Services.

<comment><USER87> Which is already more than any other FOSS UNIX.

As for macOS, I am sure that it will come, as these features have been slowly being added release after release.</comment></comment></comment></comment></comment>


Video interviews with the homeless for $1USD/minute - <AUTHOR> http://www.randomli.com/projects/the-one-dollar-interview-project/

<comment><USER2> I like the idea, but it kind of feels like taking advantage of the homeless. Sure, some money is better than none, but only five bucks for a 5-minute interview? It almost feels demeaning.

<comment><USER3> $1/minute is $60/hour, which isn't bad. People work on Mechanical Turk for a few cents per minute.

<comment><USER4> Or think about it this way: buy me a pizza, and I'll talk to you for as long as it takes me to eat it. Seems perfectly reasonable to me.</comment></comment></comment>


Unfolding the 8-Bit Era: 8 players, 8 projectors, and one NES [video] - <AUTHOR> https://www.youtube.com/watch?v=SyU7Fscd2KU <comment><USER2> Get rid of the need to turn your head (e.g. turn it into an extended map with the active screen still centered), and you could do some interesting things with this and adventure games like Metroid or Zelda. Imagine playing the original Metroid but being able to zoom in or out Google Maps style to show more or less of the world around the current room.

</comment><comment><USER3> Holy cow, it never occurred to me that old side scrollers could be hacked to offer compelling VR gameplay (Though I think the brief demo at the end of the video is still sub optimal)

<comment><USER4> Hmm. I think "compelling" might be overselling it. As an installation with 8-player serial co-op, it's awfully cool, but as a single-player VR thing, it's a mildly interesting gimmick.

As far as home uses of the technology, I'm most intrigued by the potential for automatically creating screenshot maps like you used to see in Nintendo Power. :D You'd have to elide the status bar for games that scroll in two dimensions, but that wouldn't be hard.

</comment></comment><comment><USER5> That is pretty cool. I suppose the "8-player" does not mean simultanioues 8-players but probably 4-player max what the NES can do and there is some multiplexing going on (using an Arduino) so you can have more people round the table for crowd control. Ah, yes, found the setup diagram:

[http://cdn.arstechnica.net/wp- content/uploads/sites/3/2015/1...](http://cdn.arstechnica.net/wp- content/uploads/sites/3/2015/12/unfolding-8bit-architecture.jpg)

<comment><USER4> It's described in the video. They're playing single-player games; control rotates between eight players as the game's scrolling advances. Players have to coordinate to hand off control as they cross the borders, without the in- game character hesitating and getting shot or falling into a pit. The multiplexing is done outside of the actual NES, so its native capabilities don't matter.

</comment></comment><comment><USER6> Why not modern side scrollers too? I guess broforce would be great on this. They should contact the developers and have them support a custom version with 8 rotating players and possibly true support for the trailing screen.

<comment><USER7> This could also be very cool on games that scroll in all 4 directions where you explore a landscape...

</comment></comment><comment><USER7> Take this idea, but also

• use an untethered GearVR headset,

• emulate the NES on the smartphone inside the GearVR,

• use a bluetooth gamepad

• sit on a swivel chair and - perhaps -

• replace the perpendicular walls with the inside of a large cylinder ...

sounds awesome!</comment>


Blurry Fonts on OS X Yosemite - <AUTHOR> https://discussions.apple.com/thread/6602718

<comment><USER2> The slight irony is I think they have actually improved font rendering, and they're now sharper than they were.</comment>


Is the iPhone 5s worth it?  - <AUTHOR>

With the proliferation of low cost, high function android phones, in your opinion, is it still worth paying the premium for an apple product? <comment><USER2> The answer to this is complicated and I'm not going to try to cover all the angles of it, so I'll simplify the answer with this: it depends on what you value and what you're willing to pay a premium for; if you care deeply about the optimal ratio of commodity functionality versus price, then the iPhone 5s (or most any Apple product) is probably not for you. That is NOT meant to be a snobbish, classist, elitist jab and I mean that respectfully.

In a similar vein, yes you could do similar things on a $500 Lenovo laptop compared to a $3000 Retina Macbook Pro; driving a Tata Nano or Honda Civic will get you to your destination just as fast (within reason) as a nicer car. Buying the cheapest food possible will get you calories just like more expensive food... the list goes on and on with other things (clothes, coffee/tea/wine, jewelry, etc).

So ask yourself: what did Apple value when they designed and manufactured the iPhone 5s, which are different than the values used to produce competing products? If those values are similar to your values, then it's worth every penny.

<comment><AUTHOR> Perfect! This sums up what I felt after consulting all the tech guys I know and trawling the web from 5s links. Well articulated.

</comment></comment><comment><USER3> IMO, don't worth it. Sam is good enough. Your pay for brand mostly. It's like to compare what's better Mercedes or BMW. Probably you are a member of some fraternity it would be must. Apple's prices are unfairly high.</comment>


Propeller: Front-End Framework Based on Google's Material Design and Bootstrap - <AUTHOR> http://propeller.in/ <comment><USER2> Can you explain the difference (pros/cons) between using this and using Bootstrap with a Material Design theme.

Thanks</comment>


Geoguessr - <AUTHOR> http://geoguessr.com/

<comment><USER2> Ha, addictive!

I wonder if it has a bias towards the IP of the player? I kept getting locations in my country, much more than it felt like I should be if it were totally random.

<comment><USER3> I got them from all over the world, but it is of course restricted to places where Streetview is available, so you won't get one in Germany for example.</comment></comment>


Police begin operational use of live facial recognition technology in London - <AUTHOR> http://news.met.police.uk/news/met-begins-operational-use-of-live-facial-recognition-lfr-technology-392451 <comment><AUTHOR> There are a lot of things going on that I find interesting. But one that has caught my attention is the realization that surveillance is a profitable business.

Live facial recognition deployments cost a lot of money. Just in Cardiff alone the police spent 3 million pounds in this technology. And they have more than 25 police officers and with brand new iPads surveilling people in real time. (I was there.)

Imagine how much money they're going to spend in London now. So besides the obvious human rights related questions, the other not so obvious one is: Who is getting these contracts? Where is that money going?

<comment><USER2> Who is getting these contracts? Where is that money going?

From the official PR, it is NEC Corporation.

[https://www.nec.com/en/case/mps/index.html](https://www.nec.com/en/case/mps/index.html)

Metropolitan Police Press Release. [http://news.met.police.uk/news/met-begins- operational-use-of...](http://news.met.police.uk/news/met-begins-operational- use-of-live-facial-recognition-lfr-technology-392451)

<comment><USER3> Don't worry, none of our senior politicians have a track record of directing public funds to private companies owned by people they're sleeping with.

<comment><USER4> who are you referencing here?

<comment><USER5> Boris Johnson presumably.

<comment> dane-pgp I think the comment above is correctly guessing who Traster was referring to, specifically this controversy:

[https://www.independent.co.uk/news/uk/home-news/boris- johnso...](https://www.independent.co.uk/news/uk/home-news/boris-johnson- jennifer-arcuri-model-london-mayor-friendship-conflict-interest-a9115211.html)

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Big Brother Watch, the UK campaign group fighting facial recognition has opened a petition to stop the deployment of live facial recognition by the Met Police:

[https://you.38degrees.org.uk/petitions/stop-the-met- police-u...](https://you.38degrees.org.uk/petitions/stop-the-met-police-using- facial-recognition-surveillance)

</comment><comment><USER6> So where the EU is now weighing a 5yr ban on FR, the UK after Brexit seems to be going full on to adoption?

<comment><USER7> that is kind of the point of brexit. UK elites have been frustrated at not having the kind of totalitarian control they desire thus far

<comment><USER8> I'm not sure what you mean by that being the point in brexit. Theresa May voted for remain and introduced bills like this one: [https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016](https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016)

<comment><USER7> EDIT: your link kind of proves my point:

"On 21 December 2016, the European Court of Justice (ECJ) declared that the generalised retention of certain types of personal data is unlawful, although little is known as to how this will affect the Investigatory Powers Act at this stage."

also my perception is that may and cameron were doing reverse psychology by backing remain

<comment><USER9> I mean Cameron did put it to a binding referendum with a simple majority. At least part of him was in support of leaving for him to do that.

<comment><USER10> The referendum was advisory/non-binding.

[https://fullfact.org/europe/was-eu-referendum- advisory/](https://fullfact.org/europe/was-eu-referendum-advisory/)

</comment></comment></comment></comment></comment></comment><comment><USER11> The story as reported by the BBC, [https://www.bbc.co.uk/news/uk-51237665](https://www.bbc.co.uk/news/uk-51237665)

</comment><comment><USER12> Url changed from [https://twitter.com/bbw1984/status/1220681916543840257](https://twitter.com/bbw1984/status/1220681916543840257), which points to this.

If anyone finds a more neutral and substantive article on this, we can change it again.

</comment><comment><USER13> Imagine that a so called democratic country like the UK would go down the same road as bad and evil China ...

</comment><comment><USER14> This is interesting in that it seems like explicitly __non-live __FR:[https://blog.clearview.ai/post/2020-01-23-clearview-is- not-p...](https://blog.clearview.ai/post/2020-01-23-clearview-is-not-public/)

<comment><USER6> [https://news.ycombinator.com/item?id=22083775](https://news.ycombinator.com/item?id=22083775)

</comment></comment><comment><USER7> see also: [https://www.bbc.co.uk/news/education-51196849](https://www.bbc.co.uk/news/education-51196849)

connect the dots

</comment><comment><USER15> Banksy was right …

<comment><USER16> Banksy was glib. It's different.

</comment></comment><comment><USER17> We may be losing privacy, but whether we're losing power and freedom is another thing.

It's important to accept a changing world. Luddites have railed against 'immoral' new technologies that will cause the end of the world, time and time again.

This adjustment is going to be hard. I believe privacy is a fundamental human right.

But if technology makes this concept obsolete, then we must adapt.

We may have to change our tune to defending radical acceptance of difference and fighting against thought policing and over-policing of divergent human behaviour - not the mere detection of it. Without the freedom for such creativity and normal humanness, we are doomed.

<comment><USER18> >But if technology makes this concept obsolete, then we must adapt.

The point of the Third Amendment is that people do lie. Do you trust the King's soldiers to report on the coming and goings around your house truthfully?</comment></comment>


Romanian Skimmer Gang in Mexico Outed by KrebsOnSecurity Stole $1.2B - <AUTHOR> https://krebsonsecurity.com/2020/06/romanian-skimmer-gang-in-mexico-outed-by-krebsonsecurity-stole-1-2-billion/ <comment><USER2> I remember watching a talk Brian gave where he touched on the meatspace implications of his reporting. Private security, threats of violence, doxxing.

This is the kind of stuff that people kill over. I'm really glad he's doing the work he does, I don't know if I'd be brave enough to if I were in that position.

<comment><USER3> Brian has already been through swatting, had a hacker send heroin and police to his home. I believe there was another article where he was warned by the FBI to take precautions as there was a threat against his life (I might be confusing him with someone else... it's been a while since I worked in infosec).

[https://krebsonsecurity.com/2017/02/men-who-sent-swat- team-h...](https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin- to-my-home-sentenced/)

<comment><USER4> Some lady in a mask went to his house and cut down a tree in his front yard[1].

He's been sent flower arrangements mourning the "death" of his wife[2].

His site is also the benchmark against which every DDOS system is tested.

[1] [http://www.hackerfactor.com/blog/index.php?/archives/596-Lif...](http://www.hackerfactor.com/blog/index.php?/archives/596-Life- of-Brian.html)

[2] [https://krebsonsecurity.com/2015/10/hacker-who-sent-me- heroi...](https://krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces- charges-in-u-s/)

</comment></comment></comment><comment><USER5> The $1.2B doesn't sound right. It's probably an overestimate by a factor of 100 or 1000.

Let's see:

"Investigators say each skimmer captured on average 1,000 cards per month, siphoning about $200 from individual victim accounts. This allowed the crime gang to steal approximately $20 million monthly."

To begin with: $200 x 1000 = $200,000 not $20 million.

But wait, maybe they use a card for more than a month, maybe they buy $200/month for several months. That's very unlikely. All credit card companies have very sophisticated fraud detection algorithms, and probably most people on HN can recount instances when they received a text or email from their card company about some suspicious activity. Fraudulent activity on a card to go undetected for multiple purchases, going over a period of months, that's virtually impossible.

Second: how does this square with the official statistics? The FTC publishes an annual report about consumer losses due to various types of fraud (such as credit card, identity theft, phishing, etc). The grand total for all types of such fraud was $1.9B for 2019 [1]. This counts everything, not only card skimming. Now, one can say this happened in Mexico, not in the US, but then the numbers look even more suspicious.

Third: the way this scam works is that the skimmers collect card information then pass that along. They sell lists of such cards on the black market. Some other people buy such cards and try to make fraudulent purchases. Some of the purchases will be rejected, but some will go through. The original skimmers are not involved in this part of the crime, and have no idea how much stuff was eventually bought with the cards they "sourced". So when they sell the lists on the black market, they won't get anywhere near $200 per card. I have never seen any numbers, but it wouldn't surprise me if they can't get more than $2-$5 per card.

All in all, it's likely that these guys pocketed at most a six-digit amount, and created total losses of the order of millions of dollars, but nothing withing shooting distance of $1B.

[1] [https://www.ftc.gov/system/files/documents/reports/consumer-...](https://www.ftc.gov/system/files/documents/reports/consumer- sentinel-network-data-book-2019/consumer_sentinel_network_data_book_2019.pdf)

<comment><USER6> $200k monthly for _each_ skimmer device, of which there were 100 across various tourist destinations around Mexico.

</comment></comment><comment><USER7> Brain wave: CIA agents (etc.) must have methods like this to gain cash from ATMs all around the world to survive and get by (etc.), with the assistance of NSA 0-days.

Makes sense. I'd do that if I were the intelligence community.

<comment><USER8> Why not just use a credit card?

<comment><USER9> anonymity

<comment><USER8> Option 1) rob a bank to get money. Option 2) use credit Card with fake name like a normal person.

</comment></comment></comment></comment><comment><USER10> This is why we need strong border control (including walls) and deportations in the USA:

"the group... built a human smuggling ring that helped members of the crime gang cross into the U.S. and ply their skimming trade against ATMs in the United States."

<comment><USER11> The are currently non-immigrants who are skimming way more for him and his buddies.

If you don't you think "the wall" includes some bribes and being constructed at a premium, than you aren't paying attention</comment></comment>


Ask HN: What are the 20% of ML/DL skills that are used 80% of the time - <AUTHOR> <comment><USER2> Talking about ML and DL and figuring out how companies can add a few buzzwords in their marketing to say that they use AI.

</comment><comment><USER3> One of them is probably data preprocessing: To properly prepare the data before presenting it to the algorithm.

<comment><USER4> This is one thing that frustrates me about AI. I can data pre-process all day every day, I've been writing ETLs and data warehouses for years. But what am I supposed to preprocess it to? What is the ideal shape of the data?

A lot of courses gloss over this. The dedicate a whole section to cleaning data and then skip straight to ML with datasets already made. Or slightly better, they make you pre-process the data but tell you exactly what columns you need not why. So when you have a new project unless it is near identical to the example in the course you may not know what to do.

</comment></comment><comment><USER5> model.fit()

<comment><USER6> And model.fit_transform()</comment></comment>


Ask HN: Drinks in downtown SF? - <AUTHOR> I just moved to the bay area after seven years on the east coast. Would love to meet some HNers and talk tech and entrepreneurship. Or just drink, that usually works.<p>Reply or email me (firstname.lastname@example.com) if you're interested. I'm near the Montgomery St BART stop. I'm thinking around 630PM. <comment><USER2> Nice gmail name man!</comment>


So, when do we get rid of the mouse? If anyone knows about designing for human-computer interaction - <AUTHOR> http://www.news.com/Tech-design-with-thought/2008-1041_3-6219608.html?tag=ne.fd.mnbc

<comment><USER2> I think the next step is to pick up which fingers are being pressed and moved. You can keychord to make 1024 letters, number, and commands. And by detecting the curl of the fingers, control a mouse pointer (or two).

I thought of a wrist band that senses the myoelectric impulses in your wrist to do this, but it's been patented. I'm sure there are other ways, though.</comment>


Craig 'Satoshi' Wright Threatens to Destroy Bitcoin Cash - <AUTHOR> https://decryptmedia.com/2018/11/12/craig-wright-bitcoin-cash-hard-fork/ <comment><USER2> Wright is the Trump of bitcoin land. both belong in an orange jumpsuits.

</comment><comment><USER3> TL;DR the People's Front of Judea are taking a hard line.</comment>


Ask HN: What are some exciting "soon to arrive" computing technologies? - <AUTHOR>

im not talking maybe or fantasy or out there. Talking about really interesting new stuff that is on the cusp of widespread take up but the computing industry. Maybe software or hardware. <comment><USER2> [http://www.microsoft.com/microsoft-surface-hub/en- us](http://www.microsoft.com/microsoft-surface-hub/en-us)

from Jefferson Han, of Perceptive Pixel and talk from 2006 (yes before the iPhone)

[http://www.ted.com/talks/jeff_han_demos_his_breakthrough_tou...](http://www.ted.com/talks/jeff_han_demos_his_breakthrough_touchscreen?language=en)

</comment><comment><USER3> oculus

ms holo lense

bitcoin

drones

self driving cars

NASA em drive

DARPA self balancing robo dog

hoverboards www.youtube.com/watch?v=Bfa9HrieUyQ

3d printing

self healing concrete

i need a new keyboard thats comfy, thinking like 2 sticky sensors that you put on the back of your palms under the knuckles, that read the keystrokes you intend to push but theres no keyboard there, so you can type on air</comment>


Show HN: GPG Sync - <AUTHOR> https://github.com/firstlookmedia/gpgsync <comment><USER2> It would be helpful for the README to explain the reasons you might prefer this over a traditional keyserver.

<comment><AUTHOR> It doesn't replace the traditional keyserver, it merely simplifies the process of keeping up to date public keys of members of your organization (or an organization that you follow). It also allows you to keep every member of your group up to date when new people are on-boarded with the new users pubkey.

<comment><USER3> Just as a keyserver for your org would?

<comment><USER4> But without the overhead and headache of running your own keyserver.</comment></comment></comment></comment>


Kubernetes 1.3 on Tap for Google Container Engine - <AUTHOR> https://cloudplatform.googleblog.com/2016/07/Kubernetes-1.3-on-tap-for-Google-Container-Engine.html <comment><AUTHOR> Discussion of the Kubernetes release itself: [https://news.ycombinator.com/item?id=12043972](https://news.ycombinator.com/item?id=12043972)

This is particular to Google's managed k8s cluster service.

</comment><comment><USER2> Anyone know if there is a way to run old versions of k8s on gce or does it always default to the newest one?

<comment><AUTHOR> You can't do it on the managed service (GKE) afaik, but could theoretically run it on normal Compute Engine instances instead. What's the reason for wanting to run an older version?</comment></comment>


Viva the PCB - <AUTHOR> http://www.rekeeb.com/2009/12/01/viva-the-pcb/

<comment><USER2> so this is like expressPCB + a sharing platform? i guess that's interesting. Not terribly new, though...

There's a lot of spelling mistakes in the original article, and it's bit incoherent.</comment>


Why do the Japanese draw themselves as white? - <AUTHOR> http://thesocietypages.org/socimages/2010/08/30/guest-post-why-do-the-japanese-draw-themselves-as-white/ <comment><USER3> The post makes a good point, but it does overlook the fact that the "Godfather of Anime", Osamu Tezuka (<http://en.wikipedia.org/wiki/Osamu_Tezuka>) was heavily influenced by Walt Disney and American animation.

For instance, the Wikipedia article notes: "The distinctive "large eyes" style of Japanese animation was invented by Tezuka, drawing inspirations on cartoons of the time such as Betty Boop and Walt Disney's Bambi and Mickey Mouse."

You can see how Bambi was drawn with large eyes here: [http://www.google.com/images?hl=en&q=bambi](http://www.google.com/images?hl=en&q=bambi)

You can see Betty Boop here: [http://www.google.com/images?hl=en&q=betty+boop](http://www.google.com/images?hl=en&q=betty+boop)

You can see Mickey Mouse here: [http://www.google.com/images?hl=en&q=mickey+mouse+classi...](http://www.google.com/images?hl=en&q=mickey+mouse+classic)

You can compare the style of those eyes to Tezuka's Astro Boy, first published in 1952: <http://en.wikipedia.org/wiki/File:AstroBoyVolume1.jpg>

<comment><USER4> Those characters have big eyes and foreheads for two reasons.

Firstly, to make them cuter... like babies. All baby humans have proportionally big heads/eyes to the rest of their bodies and we're hardwired to think of those characteristics as simpler, cuter, and deserving of our attention.

Secondly, to give the animator a face that is both simpler and larger which makes it much easier to draw expressions

These two things make it much easier for the audience to relate to the animated character and for the artist to draw it

<comment><USER5> I once took a Psychology course which had another explanation for the large eyes. Apparently, when humans are sexually aroused, their pupils get larger. This makes people with larger pupils more sexually appealing, leading to all kinds of tricks to making your pupils larger (for example, candlelit dinners; also, in some older civilizations, women used to use eyedrops to make their pupils larger).

All of this leads to people thinking larger pupils look better, and in the case of small cartoon characters, look cuter.

<comment><AUTHOR> The eyedrops you refer to are _belladonna_ , Italian for 'beautiful woman'.

The intro from the Wikipedia entry ( <http://en.wikipedia.org/wiki/Atropa_belladonna> ) says:

"It has a long history of use as a medicine, cosmetic, and poison. Before the Middle Ages, it was used as an anesthetic for surgery, the ancient Romans used it as a poison (the wife of Emperor Augustus and the wife of Claudius both used it to murder contemporaries) and predating this it was used to make poison tipped arrows." <USER2>
"Drops prepared from the belladonna plant were used to dilate women's pupils, an effect considered attractive."

</comment></comment></comment></comment><comment><USER6> This phenomenon is acknowledged enough by the Japanese to where it has a name: it's called "mukokuseki" which is Japanese for "no nationality". Basically it amounts to this: characters are drawn in an ethnically neutral way so that they have universal appeal, and it makes it easier to export these media works into foreign markets. Maybe the foreign markets thing was not a concern in Tezuka's early days, but it certainly is now.

<comment><USER7> Just a thought, but how is drawing them white ethnically neutral? It seems like something more beige/brown would be, seeing as how most of the world as tan-skinned.

<comment><USER8> I think it's largely because the page is white. How do you color someone beige/brown in a black-and-white medium? Specifically black and white, not grayscale.

A question to you: What is it that makes them drawn specifically white, other than eyes? Is it only the fact that they're on a white background, or is there more there that I am missing.

<comment><USER7> No that explains it. I guess I was assuming they were drawing them in color to begin with and that they were scanned into b&w.

</comment></comment></comment></comment><comment><USER9> I have always pondered this question so I quickly went to the link and was confronted with a really weak and half-baked argument. First, this is not a question of American audiences; I'm not American and love anime but they don't look Japanese to me either.

"The Other has to be marked. If there are no stereotyped markings of otherness, then white is assumed." This may be true but it has very little to do with anime. As others have pointed out (i) anime artists have been influenced by their Western counterparts (anime is not a traditional Japanese art form, you know) and (ii) commercial considerations play a role, i.e. very Japanese looking characters would have less appeal to a large audience.

But forget about that and just think about the argument to see how faulty it is: In its essence it is trying to show how lop-sided white Westerners see the world but it itself is also very prejudiced. Do you think when a Chinese person looks at an anime character they think it's Chinese (because "otherness" isn't marked)? This sort of thinking is typical of a lot of mumbo- jumbo that comes out of English departments under literary criticism. If Japanese didn't have to mark "otherness", why are the characters in traditional Japanese paintings look very Japanese (slanted eyes, hairdo, etc.).

In the end the article states: "Some Americans, even some scholars, will argue against this view of anime. They want to think the Japanese worship America or worship whiteness and use anime to prove it. But they seem to be driven more by their own racism and nationalism than anything else." This is another common tactic: when someone raises a problematic viewpoint, label them as racist, misogynistic, or worse (e.g. see the Summers episode).

How can you explain that a lot of Japanese women go through cosmetic surgery to get rid of the slant in their eyes to make them look more Western? Why is baseball so popular in Japan? Japan has had a long love/hate relationship with the US (and Westerners in general). I'm not saying some form of American idealization is at the heart of anime styles but I think it has definitely influenced it.

EDIT: For similar over the top ideas about race and culture and to see how politicized the debate can be, see [http://en.wikipedia.org/wiki/Ancient_Egyptian_race_controver...](http://en.wikipedia.org/wiki/Ancient_Egyptian_race_controversy)

<comment><USER10> "why are the characters in traditional Japanese paintings look very Japanese (slanted eyes, hairdo, etc.)."

So modern anime characters should look more like traditional Japanese paintings?

"How can you explain that a lot of Japanese women go through cosmetic surgery to get rid of the slant in their eyes to make them look more Western?"

Citation? How many is "many"?

"Why is baseball so popular in Japan?"

Because they're better at it now than Americans?

<comment><USER9> Here's ([http://www.bellasugar.com/Jessica-Simpson-Eyelid-Surgery- Pri...](http://www.bellasugar.com/Jessica-Simpson-Eyelid-Surgery-Price- Beauty-8185372)) a recent link on how popular double eyelid surgery is in Korea and Japan. I don't have the hard figures but I would guess that this procedure would be _much_ more common in Korea and Japan then in China since these populations are more affluent and were heavily affected by US presence.

As for baseball, most everyone agrees this is a quintessential American game, some authors have even suggested that it reflects the American spirit. To people from other countries it may seem slow and pointless. If you disregard Cuba, which has close ties to US historically, AFAIK the only non-American culture where baseball is very (or even on the average) popular is Japan ([http://en.wikipedia.org/wiki/Baseball#Popularity_and_cultura...](http://en.wikipedia.org/wiki/Baseball#Popularity_and_cultural_impact)).

<comment><USER10> Baseball is more popular throughout the Caribbean and Latin America than it is in the U.S., and many of the best major leaguers come from there. During the World Baseball Classic, most of the biggest names were playing for countries other than the U.S.

And Japan won the tournament, both of the times it has been played so far. The best U.S. finish is fourth.

I see the U.S. relationship with baseball becoming similar to that of England with soccer. We may have invented the sport, but that doesn't mean we're the best at it any more.

<comment><USER9> Hmm, it's hard to agree with this. I think you're equating success in world tournaments with professional level of play, which may not be the case.

As a case in point, consider the recent FIBA World Campionship: Turkey played the final with US and gave it a run for its money (at least at the start of the game). Serbia was awesome, too. The US Team didn't even make it to the final in the previous three times (<http://en.wikipedia.org/wiki/FIBA_World_Championship#Results>). Now, that _doesn't_ mean that the level of basketball in these countries is better or on par with the one in US. It just means that the very good pro players see this as a waste of time and money (and chance to be injured) and don't go. I bet a similar reason applies in the case of baseball.

<comment><USER11> US has the best players at every position in basketball, hands down. Not quite the same in baseball but you could produce a dominant American team. But might not have the best team always. I think there has been a decline in US baseball and basketball as team sports.

 _I am not sure I could empirically prove it though. I find it hard to sit through an actual game in any major US sport, though I find myself still following the NYC teams I grew up with (Mets, Giants, Knicks)._

<comment><USER10> "US has the best players at every position in basketball, hands down."

I'd take Pau Gasol over any U.S. big man. That's probably it, though.

<comment><USER11> Yes true - or perhaps Hakeem Olajuwon in his prime or Tim Duncan maybe... not quite as absolute as i made it

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> This whole thread reeks of nonsensical, "things-we-cannot-say", Politically Correct, bullshit.

Let us call a spade a spade shall we? Asians have a considerable and _measurable_ white bias when it comes to aesthetics.

[http://edition.cnn.com/2002/WORLD/asiapcf/east/05/13/asia.wh...](http://edition.cnn.com/2002/WORLD/asiapcf/east/05/13/asia.whitening/)

<http://articles.latimes.com/2005/jul/26/local/me-whitening26>

Couple the skin-whitening phenomenon with the double-eyelid surgery explosion with the open-air admission of the Asians' who elect to do these procedures that the so-called "Hellenic" features are more desirable than their own - <USER2> you have more than circumstantial evidence for the proposition "The Japanese draw themselves as white."

...And that isn't even mentioning the fact that the characters they draw, by any reasonable appraisal look about as white as Christmas in Nebraska.

If the truth offends your sensibilities, then it is your sensibilities that need adjusting.

<comment><USER13> >> Asians have a considerable and measurable white bias when it comes to aesthetics.

I'd be inclined to think you're painting targets around bullet holes there. There are procedures/products that are designed to make people look more caucasian, but you can't just ignore everything else and call it a bias. To give an example, the practice of wearing yukatas to matsuris is distinctly non-caucasian and far more common than, say, eyelid surgery.

</comment></comment><comment><USER14> I recommend the author's blog, <http://abagond.wordpress.com/>

Programmer, West Indian, NYC area, writes 500 words a day on whatever he likes. Also a father. Studied Classical Greek and Comp Sci in college:

 _People told me studying ancient Greek was a waste of time, but I learned far more about life and the world from the Greeks than from anything in computers._

I read a few posts and enjoyed them all.

</comment><comment><USER15> I think it depends on what you consider white. If you are just talking about the color of skin, Japanese are as white as Europeans. In fact, my personal view is that they are closer to white, European's skin color has a pink tone that you can't see on Japanese people.

<comment><USER16> Reminds me of a funny story a professor told me. Back in the days of apartheid, someone told a Japanese friend of his that in South Africa, that he'd have the same status as a "white", to which he retorted "Why would I want to be white?"

<comment><USER17> Relatedly, "Asian" is a category which exists in America a heck of a lot more than it exists in Asia.

(I was helping one of my friends with a grad school application. He got to race, asked me why a school would need to know this -- silly Japanese person, how would we run our racial discrimination departments without sorting you first -- and couldn't find Japanese on the menu so he picked Other. Quote, "The closest I saw was Asian American, but I think that's for Chinese people, right? Whatever, I'm certainly not American.")

<comment><USER18> This reminds me of the trouble I have with "African-American". I often have no idea where someone's cultural, racial, or national background is, and I believe it would be rude of me to presuppose a particular country. Anyway, the problem usually comes up when I'm trying to describe someone to someone else (physically, I mean). I mean, if I work with three people who are black and 50 who are not, there is an obvious way to narrow down the description. Same as of they had another distinguishing characteristic. If I (a rather white guy) were the odd skin tone out I'd fully expect to be described by it.

I understand the idea that a person is not defined by their skin color. But, really, I'm generally not talking about someone else's background as much as I'm asking a third party if they know them.

More on topic, it would seem that a good artist specifies a particular cultural background for a character if it enhances a story. Otherwise, it is often the case that any cultural baggage is brought by the viewer/reader.

<comment><USER19> This reminds me of a story that my friend told me from when she was at college.

The daughter of the ambassador from Jamaica was a student at the college, and she was being interviewed by the student newspaper as an interest piece.

The interviewer apparently asked her how she felt being an African-American at the (predominantly white) college.

The interviewer could not fathom why the daughter (being neither African nor American) was upset by the question.

That, and living in a foreign country has pretty much made me give up on the PC-ness that American creates. I'm as white as the Whitey-white white, and I feel that no one could be faulted for telling me otherwise.

Interestingly enough, when I tease my wife about our (half-hungarian, half- japanese) daughter about being part of "Team Whitey," she always responds by saying that our daughter is part of "Team Yellow."

While horribly non-PC in America, it brings into light the amount of power that words like that have, and how they have almost no power if there's no history or culture backing them.

Thinking about it further, I find it interesting that "Team Whitey" sounds perfectly fine and dandy in an English context, while "Team Yellow" seems racially insensitive.

Strange what a single color-change can make.

\-- END Random rambling

<comment><USER20> _The interviewer apparently asked her how she felt being an African-American at the (predominantly white) college._

 _The interviewer could not fathom why the daughter (being neither African nor American) was upset by the question._

Since when are black Jamaicans any less African than black United States-ians?

</comment></comment></comment></comment></comment></comment><comment><USER21> Just out f curiosity, what kind of people are asking this question?

I've been an anime fan for years and this question has legitimately never crossed my mind despite being cynical and critical of almost every single factual inaccuracy I come across.

Interesting article all the same!

<comment><USER5> I had the same question. I didn't think it was a big deal, since I figured that other people ask the question and it just never occurred to me. Then I came across the last sentence of the article:

"Some Americans, even some scholars, will argue against this view of anime. They want to think the Japanese worship America or worship whiteness and use anime to prove it. But they seem to be driven more by their own racism and nationalism than anything else."

After that kind of sentence, I really expect _some evidence_ that someone, somewhere has this view.

<comment><USER22> Look at this: [http://www.google.com/search?&q=site:answers.yahoo.com+J...](http://www.google.com/search?&q=site:answers.yahoo.com+Japanese+worship+white+people)

<comment><USER23> Look at this: [http://www.google.com/webhp?hl=en#sclient=psy&hl=en&...](http://www.google.com/webhp?hl=en#sclient=psy&hl=en&site=webhp&source=hp&q=site%3Aanswers.yahoo.com+why+cant+white+dance&aq=f&aqi=&aql=&oq=site%3Aanswers.yahoo.com+why+cant+white+dance&gs_rfai=&pbx=1&fp=6052204b889acdd8)

What's the point. I bet there are a million bigots, immature kids, and ignorant people asking questions on Yahoo Answers. Unfortunately every country has people like this, it's not exclusive to one area.

Let's just all read this and decide collectively that Yahoo Answers should never again be used as debate source material: [http://answers.yahoo.com/question/index?qid=20100317231952AA...](http://answers.yahoo.com/question/index?qid=20100317231952AAtrZSE)

<comment><USER22> You are right. edanm asked for some evidence that there are idiots who think Japanese worship white people. It seems there are many, so the article really targets an existing problem. That's the point.

<comment><USER5> I was specifically looking for evidence that _scholars_ believe this. I don't doubt there are idiots who believe all kinds of things!

And by the way, what's up with the people posting that Yahoo! question? If it's not a joke, I'm seriously worried about the state of humanity.

<comment><USER22> Voila:

 _"The ultimate reason for the lower Japanese body esteem may perhaps concern broader cultural and historical perspectives. Being part of the West, but non- Caucasians, Japanese people seem collectively to experience high incongruence between their Western-oriented bodily ideals and the perceptions of their own body. "_

Japanese body image: Structure and esteem scores in a cross-cultural perspective by Rotem Kowner, University of Haifa, Israel, in: INTERNATIONAL JOURNAL OF PSYCHOLOGY, 2002, 37 (3), 149–159

[http://www.sjsu.edu/people/jennifer.anderson/courses/c5/s1/K...](http://www.sjsu.edu/people/jennifer.anderson/courses/c5/s1/Kowner_Japanese_Body_Image.pdf)

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> I'm going to give what is probably a very contrarian view here: scientific studies show that Caucasian features allow for a higher standard deviation than Asian features. (That is to say, both Asian and Caucasian test groups think two randomly-sampled Asians look more similar than two randomly-sampled Caucasians.)

When you have 10 or 20 characters, and want them to be recognizable at a glance (for brand ownership), even when appearing completely out-of-context alongside characters of similar ages and styles from other series, and even when drawn minimally and potentially badly by a subcontracted art studio--it's logical to make them whatever race has the widest "visual range." It's also logical, for the same reasons, to give them technicolor hair.

<comment><USER25> Something I learned in a journalism class relates to this: "I'm going to give what is probably a very contrarian view here: scientific studies show that Caucasian features allow for a higher standard deviation than Asian features."

Don't just claim "scientific studies say X;" cite studies Y, Z, and A. I'm not saying that your claim is wrong, but it sounds implausible to me, and I suspect that, if such studies exist, they probably indicate that whites find it easier to differentiate other whites and Asians find it easier to differentiate other Asians (I'd be curious: are such studies done solely in the United States? If so, they'd be worthless).

<comment><USER24> You're quite right, of course--but I think that, in any case where the person actually has access to a study they mention (and isn't, say, typing this reply on a phone while in gridlock on public transit), they would simply cite it, as it would strengthen their argument at no cost. Thus, you can take any assertion, including mine, that mentions that "studies say", as simply positing that there _could_ be studies of such a type, and exploring the any implications made possible by that assumption.

In this particular case, I believe the best I can give you is that I heard it from a science podcast of some sort.

</comment></comment></comment><comment><USER26> What struck me as odd in Asia were all the skin whitening products. Even regular cosmetics had "Whitening" plastered over it.

<comment><USER27> You see a lot of that in the Philippines especially. Everyone wants to be as white as possible, so they carry umbrellas to block the sun, and use whitening lotions and soaps. Contrast that with the US, where people want to be tan, to the point of using tanning salons and spray-on tans.

<comment><USER28> I had initially assumed that whitening creams were used to create a caucasian look - an idea which I found quite repulsive. When a friend explained that it was to mimic the appearance of the upperclass, whose skin colour contrasted with a labourer's, it began to make sense. When thought of as a status enhancer, it doesn't seem that disimilar to tanning..

<comment><USER29> It's funny, a friend of mine asked me why "all Japanese people want to look white" as I am from japan (I don't look even a little bit white, let alone Japanese). The fact is that paleness has been associated with beauty there since before they knew that Caucasians even existed. So I don't particularly have an answer, but it's clear that it's not that they want to be white because Caucasians are white.

<comment><USER30> +1 for not looking Japanese.

A former hostel-mate of mine was Japanese and we would hangout with the Japanese expats in Shanghai. 100% of the time, Japanese people would speak English to him. I forgot where exactly in Japan he is from, but he said everyone in his home town looked like him, but Japanese people elsewhere would assume he is something else; 6.4 tall, full beard, and looked a lot like Tarkan, the Turkish singer:

[http://www.frogview.com/uploadimages101/476366f66b4d62.07061...](http://www.frogview.com/uploadimages101/476366f66b4d62.07061974frogview- gallery.jpg)

A year later when I went to Japan I found out how unusual looking he was.

</comment></comment></comment></comment></comment><comment><USER31> Simple because paper is white?

<comment><AUTHOR> Your common sense reply shows how easy it is for us to get distracted by issues of race, culture, westernization.

</comment></comment><comment><USER32> I think I read once that Asian people pay more attention to the eyes than other facial features when they are reading emotions. The hypothesis was somehow based on the fact that the emoticons Asians use tend to mostly show the eyes. Since it's difficult to show emotions on a cartoon, perhaps drawing big eyes started as a way to make it easier for the artist to express anger, happiness,... on what they drew.

They might look whiter than Asian, but it probably has nothing to do with Asians wanting to be white. You can probably test what the OP said by asking a villager in Africa which race those cartoons belong to assuming he's seen an equal share of whites and Asians.

<comment><USER33> _Everyone_ pays attention to the eyes when they are reading emotions. That's why eyes are called "the window to the soul."

<comment><USER34> No, he's right. There is at least one eye-tracking study that shows that people from Asian cultures pay greater attention to the eyes when reading expressions. Relative to the Asians in the study, the Caucasians relied more on other parts of the face.

[http://www.newscientist.com/article/dn17605-human-facial- exp...](http://www.newscientist.com/article/dn17605-human-facial-expressions- arent-universal.html)

It's not clear whether it might be influencing different art styles, though.

</comment></comment></comment><comment><USER23> I have to admit, I always wondered why Naruto was a blue-eyed blonde white kid. This article helped me consider some of my own reasoning. I had just assumed Naruto had characters that reflected a mix of races instead of one race. The last sentence of this article is offensive though. It's a derogatory generalization. Personally it doesn't matter to me what the characters look like and I don't see why someone relating to a character is a negative.

<comment><USER24> Actually, he's blonde for the same reason that a lot of male ankle protagonists are: because, as an asian teenager, dying one's hair blonde and showing up starkly against a sea of black hair marks you as _rebellious_ \--and thus, in Japan especially where "the nail that stands up gets hammered down", gets you treated with a bit more disdain by both peers and elders. For younger kids who feel out of place for all the regular reasons of childhood and pubescence, a naturally blonde-haired character feels like someone they could identify with.

<comment><USER24> (And, in case anyone is confused: iPhones don't know the word _anime_.)

</comment></comment></comment><comment><USER35> This "article" seems to be very light on basically anything. Especially facts. How much karma does it take on HN to vote things down?

<comment><USER36> I was okay with it until here:

"Some Americans, even some scholars, will argue against this view of anime. They want to think the Japanese worship America or worship whiteness and use anime to prove it. But they seem to be driven more by their own racism and nationalism than anything else."

It's a red flag when you preemptively declare all of your opponents racists before they've even had a chance to respond.

Maybe someone will disagree for a non-racist reason? Just maybe?

<comment><USER37> Well, that's inflammatory, but what if it's true?

Because it is such an inflammatory statement, it should be better supported, if that was the author's main point, or omitted, if it wasn't.

There's something else at work, though. I think that as soon as many readers read "racist", they mentally shut down as a defence mechanism.

"B ... b ... but it's an axiom that I can't be racist, so any argument that might cast me as racist must be wrong, without further consideration." It's the same thing you're arguing against.

<comment><USER36> I read your reply earlier and didn't quite get it, but I think now I see your point.

My response would be that it's okay to unequivocally declare a _class of arguments_ as wrong. "Wrong" in the sense of a bad argument that doesn't hold up, it could still (coincidentally) reflect the correct position. What the author does is different though, he simply declares an entire side wrong on the assumption that they all must be using a certain class of arguments.

But the example you offered does demonstrate an equally important point: There are correct and incorrect reasons to rule out a class of arguments. Clearly "if this were true I'd be bad person, therefore this is false" is one of the bad reasons. The technical term is "argumentum ad consequentiam": appeal to consequeces.

So you're absolutely right to preach caution here.

</comment></comment></comment></comment><comment><USER38> This is a nice thought-provoking article.

Pale white skin has a history here in Japan much longer than anime. Look at geisha for example. On the other end of the spectrum, there were Gangaru walking all around tokyo at one point too:

<http://en.wikipedia.org/wiki/Ganguro>

Japanese women especially are well aware of their skin's natural ability to change color and often treat it as a fashion decision.

A heavily tanned caucasian can be much darker than an asian, latino, african american, etc... I think many westerners would be surprised that caucasians don't always have "white" skin if they actually looked around the world with a critical eye.

</comment><comment><USER39> cmon, its a little off that when Goku goes super saiyen he turns blond and blue/green eyed, no?

</comment><comment><USER40> Originally posted as [http://abagond.wordpress.com/2010/06/16/why-do-the- japanese-...](http://abagond.wordpress.com/2010/06/16/why-do-the-japanese- draw-themselves-as-white/)

</comment><comment><USER41> The more a stylized a cartoon character is, thee more it look like _you_. E.g what ethnicity does this character have: ☺ ? I bet it has the same ethnicity as you!

<comment><USER42> >what ethnicity does this character have: ☺ ? I bet it has the same ethnicity as you!

It has no ethnic origin beyond unicode. Just like it has no eye colour, no skin colour (no skin), etc.. Am I weird about this?

I really can't say I've ever thought of a stick figure as coming from a particular place or having a particular identity. But then I don't really identify with a particular location, I'm just happy to be in it in preference to other places.

</comment></comment><comment><USER43> What is striking about this entire affair is just how politically incorrect it is to suggest that East Asians want to look White, whereas, say, to suggest that East Asians want to look African would sound merely quaint. Substitute East Asians with any other 'race', and it's the same story.

Man, have we some issues to work through!

</comment><comment><USER44> I hope part 2 explains why anime villains are almost always drawn to look like girls and assumed male.

</comment><comment><USER45> This doesn't explain or even address why the Japanese favor 'large round eyed' actors in ads for beauty products, why darker skinned Japanese women are not featured on TV, and why the current depictions of beauty in Japan eschew many traits common to classical Japanese portrayals of beauty.

It is glaringly obvious that European ideals of beauty have enormously affected the Japanese aesthetic, especially including anime; almost any Japanese person you meet will readily admit to this, to claim otherwise takes willful ignorance.

</comment><comment><USER46> I know for sure that all of the Manga style drawings DO NOT look asian, so there was a marketing element to it. Seems like Japanese creators wanted to make Manga universal and appealing to everybody - and of course they were successful at it. So, rather than drawing asian looking characters, they have created a "universally appealing" characters. This is equal to "bigger audience".

</comment><comment><USER47> I am seriously disappointed with how the skin tone issue was blown off in about half a sentence. I understand that there is great variability in Japanese ethnic skin tone, but it seems like the majority of Japanese have a dusky skin tone while the majority of anime characters have a very pale skin tone.

</comment><comment><USER48> The post features four anime characters. Two of the characters are clearly blonde... and I'm pretty sure this isn't my whiteness just _projecting_ blondeness. Very few Japanese people are blonde. Is it racist for me to notice this?

</comment><comment><USER49> isn't it less work?

</comment><comment><USER50> I find it more interesting that the female models you see on billboards and such in Japan are distinctly more caucasian looking than the population: rounder eyes, narrower face.

The popularity of actual caucasian models in advertisements is also interesting.

</comment><comment><USER51> Cat-like faces or baby-style faces - big eyes, small nose, triangle-shaped with small chin. Everywhere in the world children love kittens. There is no deep psychological, let alone political influences.

</comment><comment><USER52> Counterpoint: [http://seattletimes.nwsource.com/ABPub/2007/11/07/2003999607...](http://seattletimes.nwsource.com/ABPub/2007/11/07/2003999607.jpg)</comment>


What consulting means to me (/what I can't stand working at someone else's company) - <AUTHOR> http://use.perl.org/~scrottie/journal/34141 If you're average, you fit right in. And if you're above average, the basic terms of employement and premise of the arrangement is against your interests. <comment><USER2> Student -> Employee -> Contractor -> Founder -> Investor

</comment><comment><USER3> Exactly. All you gotta do is deliver.</comment>